- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Unfamiliar Syntax in Query
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I have a query, written by someone else, that I'm trying to understand: tstats count as count sum(sessionLength) as volume where (index=accm_*) name="John",selectors{}.category{}=* by selectors{}.categories{}, |.... I can not find a reference anywhere for the selectors{}.category{}. Could someone please point me in the right direction? Thanks.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
First of all are you getting output? query fails here itself at index-accm_* it should be index=accm_* can you paste entire query in 101010 sample code format.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
First of all are you getting output? query fails here itself at index-accm_* it should be index=accm_* can you paste entire query in 101010 sample code format.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Sorry, that was a typo on my part. Due to sensitivity I cannot copy paste the entire query.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
okay now it looks better so if you look the raw data in verbose mode that is type this search query index=accm_* name=* you should see a field name selectors{}.categories{}.
You are basically doing event count and sum of session length by categories(values in the selectors{}.categories{} field )
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Okay, so that's just some kind of internal field name that you only see when verbose mode is enabled. Thank you.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
yeah the query is written in tstats (which will not allow you to look at the raw data and is basically use for faster processing of searches when data model acceleration is ON)
Enterprise Security Content Update (ESCU) | New Releases
Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?
Index This | What are the 12 Days of Splunk-mas?
